427 Botnet fm qxd

www.syngress.com
Botnet Detection: Tools and Techniques • Chapter 5
171
427_Botnet_05.qxd 1/9/07 9:59 AM Page 171

---

■
[-> $HOME_NET any]
specifies that the target IP should be on the
local network, but again, on any port.The 
$HOME_NET
variable is
set by the administrator to refer to an appropriate IP range belonging
to his organization.
■
[ (msg:”W32.NetSky.p@mm - MIME”;]
specifies the message text.
■
[content:”X7soIUEAR4s3r1f/E5UzwK51/f4PdO/+D3UGR/83r+sJ/g
8PhKLw/v9XVf9T”]
specifies the signature.
■
[; classtype: misc-activity; rev 1;)]
specifies that the event is to be logged
as “misc-activity.”
In his paper,
Anti-Malware Tools: Intrusion Detection Systems
, presented at the
EICAR 2005 conference (http://arachnid.homeip.net/papers/EICAR2005-
IDS-Malware-v.1.0.2.pdf ), Martin includes a number of other examples, one
of which we can’t resist quoting, slightly modified.This rule adds the capa-
bility of alerting on or blocking some e-mail attachment types by filename
extension.The file types specified are, when found attached to e-mail, far
more often associated with mass-mailer viruses and worms, bots,Trojans, and
so on than they are with legitimate and desirable programs. (The list of exten-
sion types could be a lot longer, but this rule on its own is capable of
blocking a wide range of e-mail-borne malware.)
alert tcp $EXTERNAL_NET any -> any any (msg:"Bad Extensions
Match/PCRE";pcre:"/attachment\;\W{1,}filename=["]\S{1,}[.](scr|com|exe|cpl|pi
f|hta|vbs|bat|lnk|hlp)/";classtype:misc-activity; rev:1;)
The main novelty here is the 
pcre
directive, indicating the use of Perl
Compatible Regular Expressions. For much more information on writing
Snort rules, see www.snort.org/docs/writing_rules/, part of the Snort Users
Manual.
Snort_inline is a version of Snort modified to accept packets from iptables
via libipq, instead of libpcap, using additional rule types (drop, sdrop, reject) to
drop, reject, modify, or pass the packet according to a Snort rule set.